Search

• Review existing data: Review the data already collected and how it can be reused in the service. Where appropriate, consider if safe, ethical data-sharing arrangements under the Data Availability and Transparency Act Scheme can be employed. Actions to leverage ethical, data-driven decision making can be found in Criteria 5 (‘Build Trust in Design’) and Criteria 7 (‘Do No Harm’).

To meet criteria 6 of the Digital Service Standard refer to the Digital Access Standard. The Digital Access standard is an extension of criteria 6 of the Digital Service Standard. 

• Uphold digital rights: Consider how the service might impact the digital rights of users. Build with pre-emptive measures in mind, such as net neutrality, access to information without censorship and freedom of online assembly. Identify users facing greater personal risks and make sure they’re provided with the means to access, communicate and contest the service transparently or anonymously. If rights are breached, move quickly to implement changes that prevent future harm.
• Consider flow-on effects: Consider the implications of the service beyond its immediate impacts. Workshop environmental, economic or social impacts and undertake scenario planning to explore unforeseen issues and opportunities.

• Undertake a Privacy Impact Assessment: Undertake a Privacy Impact Assessment to capture issues. Mitigate unwarranted and unauthorised surveillance, data collection and malicious data breaches and share these actions with users.
• Obtain consent: Where required, seek and obtain informed consent from users prior to collecting, storing or disclosing any of their data. Consider opt-out options and build the service to require as little user data as possible.
• Be transparent: Communicate how data will be used or may be used in the future at the time of consent. This includes how it may be shared with other people or between services and secondary or less obvious uses.

• Use data ethically: Data should only be collected and used for the stated purpose that the user agrees to. Account for how data models, datasets and algorithms may produce discriminatory results and provide transparent detail to users on how decisions and calculations are made. Before sharing data, apply the DATA Scheme’s Data Sharing Principles to help assess whether it would be safe to do so.  
• Use qualitative and quantitative data: Quantitative data, which is numeric or measurable, helps us understand what is happening on a service. Qualitative data, which is descriptive or observable, helps us understand why. Use both to fully understand the story and match any correlation with a provable causation. Do this before making important decisions.

Regularly undertake privacy impact assessments and plan to incorporate these service improvements. Use methods or tools such as:

• Develop a standardised framework for conducting privacy impact assessments. The framework should outline the steps to identify and assess privacy risks associated with new projects or services.
• Involve relevant stakeholders, including legal, compliance, IT and user representatives, in the privacy impact assessment process. This can help identify potential privacy risks and ensure assessments are comprehensive.
• Establish processes for ongoing monitoring of privacy impacts as the service evolves. Regularly review and update the assessment to reflect changes in data practices, technology, or regulations.
• Map out how data will be collected, processed, stored, and shared throughout the service lifecycle. Understanding these data flows is crucial to identifying potential privacy impacts.

Collect, store and use data ethically. Embed these methods into your ongoing processes and clearly communicate to users how their data is stored and used:

• Adopt a data minimisation principle and only collect and store data that’s necessary for the service's functionality. This limits exposure to privacy risks.
• Evaluate the quality of the data collected. Ensure that data is accurate, relevant and up to date to avoid misinterpretations and misuse.
• Establish clear data retention policies that outline how long the data will be stored and the criteria for data deletion. This prevents unnecessary accumulation of data over time.
• Implement role-based access controls to limit access to sensitive data. This reduces the risk of unauthorised access and enhances data security.
• Establish and publish ethical guidelines regarding the collection, use and sharing of data. These guidelines should prioritise user privacy and consent.
• Conduct regular audits of data collection and usage practices to comply with ethical guidelines and regulations.
• Develop clear and concise privacy notices so users know how their data is collected, used and shared. Ensure these notices are accessible, easy to access and understand.

Document your findings and recommendations to apply criterion 7:

• Clearly document privacy risks, potential impacts and mitigation recommendations.
• Create actionable plans to address risks, including technical controls and policy revisions. Establish ongoing monitoring to update assessments as the service evolves
• Map the data lifecycle, including collection, processing, storage and sharing, to identify potential privacy issues. 
• Make sure the data is collected and documented in a centralised knowledge repository. 
• Thoroughly document findings of the privacy impact assessment, include identified risks, potential impacts on user privacy, and recommendations for mitigating those risks.
• Create action plans to address findings of the privacy impact assessment. This includes implementing specific technical controls, revising policies, or enhancing user communications regarding data practices.

• Privacy impact assessment tool | OAIC
• Step-by-step guide to Privacy Impact Assessments | Office of the Information Commissioner Queensland (oic.qld.gov.au)
• Privacy impact assessments – Office of the Victorian Information Commissioner (ovic.vic.gov.au)
• Privacy Impact Assessment Guide – Office of the Victorian Information Commissioner (ovic.vic.gov.au)
• Undertaking a Privacy Impact Assessment | Office of the Information Commissioner Queensland (oic.qld.gov.au)
• Retaining, managing and disposing of data and datasets | naa.gov.au
• Guide - Data Sharing and Privacy (nsw.gov.au)
• Securing customer personal data | Cyber.gov.au

• Stay current: Technology can advance at a staggering pace. If available, refer to government guidance on risks, opportunities and developments for up-to-date advice on critical or emerging technology that may impact the service.
• Regularly check the Australian Government Architecture: Follow published guidance in the Australian Government Architecture for the adoption of critical and emerging technologies.

• Consider interoperability: Consider if new technologies will impact the service’s interoperability. Plan for its introduction or implementation in partnership with other affected agencies to prevent further divergence or disconnection.
• Be digital ready: Undertake an assessment of the preparedness for new technologies. Consider the resources and training for a new technology that will be required by the agency and team.

• Track adoption: Prior to implementing a new technology, determine whether it aligns with the clear intent of the service and whether it risks leaving certain types of users behind. If implemented, monitor how users respond to the new technology and respond to any accessibility or usability concerns.

Understand the latest guidance on critical and emerging technologies and track the adoption of new technology:

• Encourage staff to engage in ongoing training and professional development related to critical and emerging technologies. This includes conferences, webinars, or workshops about the latest advancements.
• Stay updated on guidelines and standards from reputable organisations that outline best practices for adopting and implementing new technologies.
• Collaborate with academic institutions, research organisations and industry leaders to access research findings and insights on emerging technologies. Partnerships facilitate pilot projects and experimentation.

Conduct environmental scanning to assess the current technology landscape and determine if adopting new or emerging technology would be beneficial. Consider how users of the service would respond to the adoption. Use methods or tools such as:

• Perform a cost-benefit analysis to evaluate the potential advantages and disadvantages of adopting new technologies. Consider factors such as efficiency gains, user experience, improvements and potential cost savings.
• Engage with stakeholders and users to get perspective and insights on the potential benefits of new technology adoption.
• Review case studies from agencies or organisations that have adopted similar technologies. This will help to understand best practices, challenges and measurable benefits.
• Use scenario planning to explore potential future states and assess how different technologies might impact service delivery and user experiences. This helps to strategically assess risks and benefits.
• Collaborate with user advocacy groups or representatives to gather perspectives on how new technologies can improve user experiences and accessibility.
• Involve users in pilot testing new technologies. Their experiences provide critical insights into usability and overall benefits, helping agencies to make informed decisions about adoption.

Document your findings and recommendations to apply criterion 8:

• Conduct cost-benefit analyses to evaluate the advantages and disadvantages of new technologies, engaging stakeholders and users to gather insights on potential benefits.
• Use scenario planning to explore the impacts of new technologies on service delivery and user experiences.
• Make sure the data is collected and documented in a centralised knowledge repository.